CVE-2025-60096

MediumCVSS 5.4

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The TheGem (Elementor) plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.

Risk Assessment

An attacker could gain access to functionality that should be restricted, potentially leading to unauthorized changes or data exposure on the site.

Recommendation

Update the TheGem (Elementor) plugin to the latest version that fixes this vulnerability, or disable it if no update is available.

Other vulnerabilities in TheGem (Elementor)

CVE-2025-62012Medium
The TheGem (Elementor) plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

Original NVD description (English source)

Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS